Qߘ�w���(0[�����j�l�N���wꢁQVp�y�a��@2�%�*�&�Kn07����<t,T�#�\�$��p�Q������(@����Q���Z����-����͟d��I����B؞�\�v 4����f����v��8��4�eE�*�G��_�� ߫�p���TL�p����=k�I4\]�!��5N��H[�{`+=X�yA!m�i��zE�5��DL�2����]-�s�(.�*>���͢F��;�����&�����>!��n���/hw�'K�S�d����I�[)�c���q"�6��(�#fr��=|5�۫��`U�_�'�f���Q�����Cx\AMi�����M7�E�K�n�I�8��jf�gP�wM8?[":A�|U,���a�UR�P�����n���8�3Z�$�q�#W�����w��g ��*Wig �#\|u�> tО ���> �xh�u�os���~j6=Z�K�Jv�5rrO��_x��U��؏oS8S��`c��^ee��M$v�ʄ���j/g�A]!)��M� � �Z��BvSE��2�Ǟy�^�W?����3ƣ�f�H٤Zu�����]$�S��y�z ��G�+_<������b�B�U��;��@��q� sQ�9�"�F�|��چ��<`K%+w�W�0@D��Rr -˺�A�9�Q����J����ñV������d�p�6�f� ��̞N:�~p��>�� <[ ps���t�U�<O�l%����h�W�+�5w����P�X�\1����Ȇ��a�5��"�M5���U�_ ��6z�o����� /Azf��I&�L92��������j�?̎bڝ�t#�����1�c�7|X3Ƙ��eU:%B����Z�w^U��kK�������r��u쿝-��3o �1'���?<�~ж�\���9G��zW��ry�����W�4r�]"+H`�BI������I���z8�M*f�ԣe3����CbgjD��J@��uz&�U�����j�7r�3����V�pK�|T��(�7���R�����C}ֺc� �E�T&�`�mt �Q|�Ҥuc @n5^������XߐĹ��֡n��I��U�*`��y��k�&��#�`(�=���-���� ���������q� ��*|˘[���7������38O���l'�&ihs��6��H�Ql��9S�]{��g��-�� �ʯ��[�d]�K�w ����wA������� >��D��5]k��n�|��ܦb^2������#�D��]�Y�/ji�9�t������/��#y�{= ��$ĉ��uP?�L�Dk�2b�dc|�$�z�r ����p��o� ����UT���z�b+����ܾ�)�Js4fG��d��쾀�����d$��P���� QE�0�0�*!�X�����(4�fy�\YVۀ�\�[�BÖ�y]��܌r���Uz��H���G=�8оS�`��3�ăA���q���궀���f5����83�����J|�{6�Z<:Ҙ��)Ӳ�+���X�� 6�����Hm�4uH�*��r���PS���Ӛ����s<[L *�>����,�M@�qڰx���I�T�ld��.��4���i����/�ѝ��v�a�����>�=l�]��9(�ϻ�>-z&��%$0�PD{7�<�N}08D���%б�߄H(ϙyV��V��SNɟ���4��V$���8�hb�ȕж BO�)���]��� Vj7�ɩֈ=>�;RRj�FgT��"�)�����J[Ox��|�yNU(��{��D����;������C��+�42��}@�ܵ[�3{}&��5�d�8<�8�b �x^�(+�H�)vά�N��R�Z��w����H��pT3+5|}�F����#�m�"�ԃ貴���`����M@�?�8)��r����;#g�C��?ضF�5����'W�Q�Iݹ�h;� M��)�=�2 Y�/%��;pH�s���r� ~)�3��x�ǐ��$ y+�Q��)CeǯN("b���6`' �5'��[��ڄ+��c��(�w{��ߛx��' |[���9̼r�ͬo5�l,r��J;�����R�DE��?!2��%���}��o�X��$zY��I:�wZ#�Q#��э( �=U祵�`*��E�%��- )�TU~�NL�{�����j�I��x�r���'�L��so>%���1&ޢ���ҹ��(��� ̾xB�3S��q����9t~�}�% �e��G���������v�A�Q �`��l��������1q�5�ӳlwVe�C�k{�>�Q�P��Ȳ!Q�W�U>~4/0�W�^��Z0G����ďD�A����!U���ce3�����#���\X�U�\�;u�`U4Қ�>O8[����-9�3@.|�P���-"U\��$��s�S�U��#R����r|�|�ST� ���x�գ>�8L���B�� cI*�o3;O]����B"?U!T�|<�mD�g{V���L�f@��\�O{}`��y�n�N%�+��=�-���Zhr/0q���3�@�����������k��9���<Я>�}����aB�j G�%:`���SZۋ��Zh���7����A��@�Nޜ{��(cҐ%� W�u}�M�*��;�0�������MN"�%<Uw�� ��w���˝!w��tmu��+pxaģ���j/���Vr>��2K���R}��o��y9���������J�Q�uz�ۣ"�k�;��Ë8�uڧ���3*�R3�V�(�8f��H���T-.:����%�BF���:�Yeq3�V��{L����E���f�@�#o�(f�|���#������p�I�����`�{�Fo�, �uɭu@�H�8���GD�XY�>��|��$h\7ی(�lEdVW2W>)۱�1^��o�_�Rsف�?.2-G�}pmT��lN�*�+Ӈê퍌w�jbQ^̒[��!D�j���(�t�)�T�g�f��.u��b���������]�'��B�rJ���]9���F�Bټ��� [�%pւq�#��cI��F�#)�qH`X,eF���7H�L{G��
Behavioral task
behavioral1
Sample
NTFHACK_UNIVERSAL_1_7_10.exe
Resource
win7-20230831-en
General
-
Target
NTFHACK_UNIVERSAL_1_7_10.exe
-
Size
5.7MB
-
MD5
12ae9fdb69caa3d8659f2f8fe38f1225
-
SHA1
d17c5d451fb8e1b111f33b004c039a4fde3c71a0
-
SHA256
e80ca113469a0308244de836f8dd96e774159fd4e77af9a77e2852399081806f
-
SHA512
fbe462b4cd00c5e184e08a3142c8e9e3cb18883ce486b7fb650103ba4aa90f37eb88801f718425e9e891d9b27a6b1362c6eab343a8fb0e6b18f3c6dabd060f28
-
SSDEEP
98304:9JGZPmBp2xf16k7U+rtDrJA/Vga/hwjcMC/da/xbPF08xXCqe5vxnuPURJEm:y9mK1rnrseaa4MCFa5bPFRxXFe/pF
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NTFHACK_UNIVERSAL_1_7_10.exe
Files
-
NTFHACK_UNIVERSAL_1_7_10.exe.exe windows:6 windows x64
cb93fad88da14a7cc79ef0b8ec48a0de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
LookupPrivilegeValueA
msvcp140
??_7_Facet_base@std@@6B@
ws2_32
closesocket
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
wcscpy_s
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
_dclass
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ